Transitive Transaction attributes

[bleinfelder]

Hi there,

I'm doing analysis on file transfer logs from different transfer system. I want to follow the file through the different systems, and unfortunately they change their names every now and then. Meanwhile I normalized all the relevant fields, so I have events like that:

sourcefile=aafile destfile=aafile

sourcefile=aafile destfile=bbfile

sourcefile=bbfile destfile=ccfile

sourcefile=ccfile destfile=ddfile

I want all these events grouped into one transaction. So far, with " | transaction sourcefile destfile", whenever the filename changes, a new transaction starts.

I found similar questions here, but no answer. Any help?

Regards,

Bernd

[bleinfelder · Accepted solution]

Hi there,

I found a solution for this: Create a multivalued field that contains sourcefile and destfile and make the transaction with that field:

sourcetype=mysourcetype| eval txattrib=mvappend(sourcefile,null,destfile) | transaction txattrib

With that expression, all four events are grouped to one transaction.

Regards,

Bernd